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ABSTRACT 


UNDERSTANDING  THE  RISK  OF  AMMUNITION  KICKOBT 
FROM  EXPLOSION  SUPPRESSIVE  STRUCTURES 

Richard  B.  Shipe 

USACSTA  ATTN:  STECS-SO 

Aberdeen  Proving  Ground,  Maryland  21005 

This  paper  presents  a  system  safety  model  that  justifies 
relaxing  operating  restrictions  at  weapons  and  ammunition 
test  facilities. 

The  mission  of  the  U.S.  Army  Combat  Systems  Test 
Activity  (USACSTA  or  CSTA) ,  Aberdeen  Proving  Ground  (APG) , 
MD,  includes  the  evaluation  of  large  caliber  weapons.  As 
these  weapons  increase  in  size,  so  does  the  danger 
associated  with  testing  them.  The  availability  of  land  for 
large  caliber  firing  ranges  is  decreasing.  Because  of  that 
unavailability,  incompatible  operations  are  often  conducted 
contiguously.  In  such  cases,  personnel  and  facilities  are 
exposed  to  the  dangers  associated  with  weapons  testing. 

There  is  no  guarantee  an  explosive  accident  will  never 
happen  in  a  test  structure,  but  it  is  a  very  unlikely 
occurrence.  For  an  accident  to  occur,  a  complex  sequence  of 
events  must  happen.  If  that  sequence  is  explicitly 
identified,  then  it  can  be  controlled.  By  controlling 
selected  hazards,  the  risk  (risk  is  the  expected  value  of  an 
event  or  accident)  can  be  reduced.  If  it  has  been  reduced 
to  an  acceptable  degree,  the  requirements  applied  to  the 
design  and  subsequent  operation  of  any  facility  can  be 
relaxed. 

Because  of  the  high  cost  of  constructing  weapons  test 
facilities,  alternatives  must  be  designed  in  the  context  of 
the  risks  associated  with  such  testing.  Using  System  Safety 
techniques,  those  risks  can  be  identified  and  modeled.  This 
paper  suggests  a  model  from  which  can  be  derived  safe  and 
cost-effective  construction,  design  and  operating  alter¬ 
natives  for  weapons  testing  facilities. 
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TITLE  Understanding  the  Risk  of  Ammunition  Kickout  from 
Explosion  Suppressive  Structures 

PURPOSE  To  inform  a  reader  of  the  risk  of  ammunition  being 
thrown  from  a  containment  structure  (e.g.  a  magazine  or 
explosive  operating  building) ,  and  whether  that  risk  varies 
with  the  design  style  of  the  structure. 

CENTRAL  IDEA  Understanding  the  circumstances  that  could 
lead  to  an  unsuppressed  detonation  of  a  munition  in  an 
industrial,  depot,  or  testing  environment  will  make  such  an 
event  more  predictable,  hence  more  preventable.  An  explicit 
model  defining  those  circumstances  demonstrates  the  low  risk 
associated  with  a  kickout,  and  it  allows  the  risk  to  be 
compared  between  construction  styles. 

CONCLUSION  Whatever  the  risk  of  ammunition  kickout,  it  is 
not  markedly  different  for  any  suppressive  structure, 
regardless  of  construction  style,  if  that  structure  has  a 
frangible  wall  that  will  be  lost  in  a  detonation  or  an 
entrance  way  that  allows  direct  access  from  the  outside. 

This  is  explicitly  defined  by  the  fault  tree  contained 
herein. 
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This  paper  synopsizes  a  study  conducted  at  the  U.S.  Army 
Combat  Systems  Test  Activity  (USACSTA  or  CSTA)  by  Mr.  Thomas  A. 
Lucas  and  1  from  January  1986  through  October  1988.  That  study 
was  recently  published  by  the  AMC  Action  Committee  for  System 
Safety  as  Technical  Report  90-4.  The  quality  and  thoroughness  of 
that  original  study  are  creditable  to  Mr.  Lucas. 

I  aT.so  acknowledge  Mr.  William  Watson  who  generated  the  cut 
sets  in  this  paper  using  the  software:  Fault  Tree  Analysis  using 
Personal  Computers  version  6,  August  1987,  developed  by  Mr.  Jack 
Copeland.  A  special  appreciation  is  extended  to  Misters  Martin 
Mossa  and  Rodolfo  Gil,  from  the  USACSTA  Safety  Office,  whose 
insights  and  criticisms  helped  focus  and  guide  the  technical 
considerations  of  this  paper. 
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Historical  Background 

The  mission  of  the  U.S.  Army  Combat  Systems  Test  Activity 
(USACSTA  or  CSTA) ,  Aberdeen  Proving  Ground,  MD,  includes  the 
evaluation  of  ammunition  and  weapons.  As  these  systems  increase 
in  effectiveness,  so  does  the  risk  associated  with  storing, 
handling,  and  testing  them.  That  increase  in  risk  is  a  result 
of  encroachment,  since  the  availability  of  land  area  for  storing 
and  testing  those  high-risk  systems  is  decreasing.  Because  of 
that  decrease,  incompatible  operations  are  often  conducted 
contiguously.  In  such  cases,  personnel  are  subject  to  high  risk 
exposure.  The  danger  inherent  in  weapon  testing,  then,  is  an 
unexpected,  unconfined  detonation  -  an  ammunition  explosion. 

This  is  so  because  high-value  facilities  and  equipment  are 
necessarily  exposed  to  the  effects  of  such  an  event,  and  more 
important,  people  are  exposed  as  well. 

Weapons  testing  is  not  confined  to  weapon  firing.  It  is  a 
range  of  tests  that  demonstrate  the  reliability  of  a  weapon  and 
its  ammunition.  In  addition  to  weapon  firing,  the  testing 
includes  regimes  to  demonstrate  the  hardiness  of  ammunition. 
Rough  handling  and  environmental  tests  are  conducted  to  prove 
that  hardiness.  The  tests  are  conducted  in  sophisticated 
facilities  which  must  meet  the  operational  requirements  of  the 
testing  and  still  embody  explosion-suppressive  qualities.  That 
those  operational  and  protective  requirements  are  contradictory 
has  resulted  in  facilities  being  designed  and  built  that  are 
adequately  suppressive,  but  operationally  restrictive. 

To  mitigate  the  real  and  political  costs  that  would  result 
from  an  explosive  accident  has  necessitated  expensive  and  con¬ 
servative  construction.  This  has  been  true  at  USACSTA, 
especially  where  test  areas  abut  densely  populated,  public 
areas.  At  Aberdeen  Proving  Ground,  there  are  two  recent 
examples;  a  14M  $  welded  steel  containment  facility  and  a  lOM  $ 
MCA  project  for  laced,  reinforced  concrete  firing  barricades, 
both  at  USACSTA.  Facilities  so  designed  and  constructed  meet 
the  dogmatic  requirements  of  design  codes,  but  may  exaggerate  or 
understate  real  dangers  and  may, then,  be  more  costly  than  nece¬ 
ssary.  Because  of  the  high  cost  of  constructing  test  facil¬ 
ities,  alternatives  designed  in  the  context  of  a  risk  profile 
(risk  is  the  expected  value  of  an  accident)  are  desirable. 

Using  analytic  techniques,  like  the  fault  tree  analysis 
described  in  this  paper,  such  a  profile  can  be  developed.  This 
report  suggests  a  profile  from  which  can  be  derived  safe  and 
cost-effective  construction,  design  and  operating  alternatives. 
This  paper  defines  the  risk  of  an  unconfined  explosion. 
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Defining  Kickout 

The  purpose  of  an  explosion-suppressive  structure  is  to 
mitigate  the  effects  of  a  detonation;  an  explosion  occurring 
outside  the  confinement  provided  by  such  a  structure  defeats  its 
purpose.  An  unconfined  detonation  creates  concern  only  in  the 
case  where  personnel,  facilities,  or  assets  are  exposed  and 
incur  some  chance  of  injury  or  damage.  Kickout  is  one  such 
exposure.  It  is  the  escape  from  a  containment  structure  (such  as 
a  storage,  operating,  or  test  facility)  of  an  unexploded  round 
of  ammunition  following  an  explosion  in  the  structure.  Although 
there  is  no  guarantee  an  explosion  will  never  happen  in  a 
suppressive  structure,  nor  is  there  a  guarantee  a  round  of 
ammunition  will  never  be  ejected,  a  kickout  is  a  very  unlikely 
occurrence.  For  a  kickout  to  occur,  a  complex  sequence  of 
events  must  happen.  If  that  sequence  is  explicitly  identified, 
then  it  can  be  controlled.  If  negligible,  then  it  can  be 
accepted . 

This  paper  models  the  problem  of  kickout,  which  affects  the 
design  of  magazines,  barricades,  and  other  suppressive 
structures.  The  model  defines  the  mechanisms  which  cause  an 
unconfined,  unsuppressed  explosion,  and  logically  describe  the 
order  of  their  occurrence.  The  solution  provided  in  this  report 
is  an  identification  of  the  events  and  hazards  associated  with 
the  kickout  phenomenon  so  its  risk  can  be  understood. 

oasorlblng  the  Fault  Tree 

The  problem,  then,  is  to  create  a  model  from  which  can  be 
deduced  the  causes  of  an  unsuppressed,  unconfined  explosion  at 
an  operating,  test  or  storage  facility.  From  that  generic 
model,  the  case  of  kickout  can  be  deduced  as  well.  The  logical 
choice  for  a  model  is  a  fault  tree. 

The  tree  defining  the  conditions  necessary  for  an 
uncontained,  unsuppressed  detonation  is  a  logic  diagram 
consisting  of  three  branches,  each  representing  one  variable  of 
a  mathematical  statement.  Logically,  the  top  event  can  occur 
only  if  the  underlying  conditions  in  each  branch  have  been 
satisfied.  Each  of  the  three  branches  defines  one  of  the 
general  conditions  leading  to  the  undesired  outcome.  That 
outcome  is  defined  as  "injury  to  personnel  or  facility  damage 
caused  by  an  luiconfined  detonation".  The  tree  flows  downward 
from  the  top  event  to  the  specific  root  causes.  General 
outcomes  at  the  head  of  the  tree  are  connected  to  intermediate 
and  root  causes  by  logic  gates.  The  gates  depict  the  logical 
conditions  of  union  and  intersection  that  are  analogous  to 
addition  and  multiplication.  Where  describing  a  fault  tree  gate 
in  the  text,  an  additive  or  union  condition  is  represented  by  an 
underlined,  italic  or,  a  multiplicative  or  intersection 
condition  by  an  underlined,  italic  and. 
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The  Head  Event 


Although  kickout  and  a  detonation  that  might  result  from  a 
kickout  are  the  principal  interests  of  the  fault  tree,  the  tree 
is  more  general.  In  it  are  addressed  many  cases  other  than 
kickout.  The  conditions  necessary  for  the  top  event  are  these: 
a  round  of  ammunition  is  unconfined  (it  is  outside  the 
suppressive  structure) ,  and  a  person  or  facility  is  exposed,  and 
the  unconfined  round  of  ammunition  transmits  energy.  Further, 
it  is  probable  that  in  a  densely  populated  area,  given  an 
unconfined  detonation,  some  damage  or  injury  will  occur. 

There  are  three  ways  a  munition  might  cause  damage.  If 
it  is  intact,  the  round  can  impart  energy  only  if  it  is  thrown 
or  propelled  and  directly  strikes  a  receiver.  Alternatively,  it 
can  detonate.  Given  a  detonation,  energy  might  be  transmitted 
via  propelled  fragments,  or  heat  flux,  or  blast  overpressure. 
Where  the  detonation  occurs  is  significant.  An  exploding  bomb 
can  cause  damage  within  some  limited  radius.  If  no  exposed 
asset  is  within  that  radius,  no  damage  or  injury  can  be 
imparted.  At  military  installations,  undesirable  exposures 
often  exist;  people  and  facilities  are  usually  within  the  radius 
at  which  a  munition,  detonating  unsuppressed,  can  cause  damage 
or  injury.  Explosives  are  stored  in  a  way  that  limits  this 
exposure.  They  are  isolated  from  populated  areas  and  stored  in 
bunkers  designed  to  contain  or  direct  missiles  and  the  shock 
wave  that  result  from  an  explosion. 

Exposure  of  Assets 

Exposure  of  personnel  and  facilities  to  the  hazards  of 
kickout  is  briefly  detailed  in  the  central  branch  of  the  tree. 
The  branch  is  separated  into  two  sections.  One  is  the  blast 
hazard  -  overpressure  and  heat  flux  -  and  the  other  a  missile  or 
fragment  hazard.  Neither  of  these  conditions  have  been 
developed  because  of  their  complexity,  although  both  normally 
exist. 

Energy  Released  by  Munition 

The  third  condition  that  must  be  met  for  the  top  event  to 
occur  is  defined  in  the  right  branch  of  the  tree.  For  exposed 
assets  to  incur  damage,  the  unconfined  munition  must  transfer 
energy.  The  transfer  might  result  from  the  blast  shock  of  the 
detonation,  or  from  missiles  and  fragments,  or  the  heat  flux  of 
the  fireball.  A  fragment  can  only  cause  damage  if  it  directly 
strikes  a  receiving  asset  and  transfers  sufficient  energy  (the 
accepted  lower  limit  for  that  energy  transfer  is  79  Joules) . 
Another  way  for  a  munition  to  cause  injury  or  damage  is  by  its 
detonation.  This  could  be  caused  by  the  proper  functioning  of 
internal  mechanical  or  electrical  mechanisms,  or  by  the 
application  of  heat  from  an  external  energy  source. 
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Munition  is  Unconfined 

The  left  branch  of  the  tree  details  the  way  blast  and 
fragmentation  mitigation  features  of  a  protective  structure  can 
be  defeated.  This  branch  defines  the  circumstances  that  must 
exist  for  a  receiver  to  be  directly  exposed  to  an  unexpected 
energy  transfer. 

Most  often,  direct  exposure  occurs  when  ammunition  is  being 
packed  or  unpacked,  transported,  or  handled  during  testing. 

While  exposure  clearly  exists  in  these  cases,  the  risk  of  an 
accident  is  controlled  through  the  use  of  training  and  special 
procedures  which  minimize  the  likelihood  of  an  event. 

For  a  kickout  to  occur,  a  relatively  intact  round  of 
ammunition  must  be  thrown  outside  a  suppressive  structure.  An 
impulsive  energy  source  and  a  path  out  of  the  structure  must  be 
present,  and  the  round,  when  thrown,  must  travel  along  that 
path.  An  impulsive  release  of  energy  is  necessary  for  a  kickout 
to  occxir.  That  release  might  result  from  a  detonation,  or  a 
pressure  vessel  failure,  o£  an  electrical  explosion.  A  path  out 
of  the  containment  structure  might  exist  because  of  a  structural 
failure,  an  inherent  weakness,  or  because  a  natural  opening 
exists  (e.g.  doors,  windows,  or  frangible  surfaces) .  It  is 
important  to  recognize  that  all  suppressive  structures  with 
frangible  walls  or  surfaces  with  access  doors  can  permit  a 
kickout.  This  weakness  is  an  inherent  characteristic  of  the 
suppressive  qualities  of  those  structures,  and  is  irrespective 
of  the  construction  medium,  whether  concrete,  steel,  earth, 
or  sheet  metal  and  sand. 
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FAULT  TREE  DATA 
INPUT  DATA  LIST 


TOP  EVENT:  PERSONNEL  INJURY /FACILITY  DAMAGE 
GATE  DATA  - 


1 
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P2DB5 

11 

CB2  A 
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1 

1 

DB2  DD2 
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CB4  A 

1 

1 

P3DB6  P3DC1 

14 

DBl  0 
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EDI  ECl 
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15 

DB2  A 

0 

3 
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2  P2EB2 

P2ED4 

P2ED5 

18 

P2DB5 

0 

1 
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O 

0 
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FAULT  TREE  DATA 


FAULT  EVENT  DATA 


1 

BDl  D 

2 

BD2  D 

3 

BD3  D 

4 

CHI  H 

5 

CCl  F 

6 

CDl  D 

7 

DDl  D 
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DD2  D 
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EDI  D 

10 

ECl  F 

11 

EHl  H 

12 

ED2  D 

13 

ED3  D 

14 

EH2  H 

15 
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16 

P2EH3 

17 
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18 

P2ED5 

19 
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20 
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21 

P2FD1 

22 
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23 
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24 
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25 
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26 
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27 
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28 
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P2FD5 
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31 

P2GC1 

32 
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34 
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35 
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MUNITION  IS  BEING  HANDLED 
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UNEXPLODED  IS  MUNITION  IS  PROPELLED 

MUNITION  FOLLOWS  PATH  OUT 

FUZE  FAILS  UNSAFE 

WEAK  WALL  DEFEATED 

HOLE  IN  STRUCTURE 

DOOR  OPERD  FOR  HANDLING 

CATASTROPHIC  LOSS  OF  STRUCTURE 

SAFETY  FEATURES  OVERCOME 

STIMULUS  e.g.  IMPACT 

PROJECTILE  PROPELLED 

H  FLUID  IS  PRESSURIZED 

D  IMMEDIATE  DONOR  EXPOSED  TO  ENERGY 

D  ENERGY  TRANSFER  TO  IMMEDIATE  DONOR 

F  LIGHTNING  STRIKE 

D  SABOTAGE 

D  PUNCTURE  TO  VESSEL  WALL 
F  CORROSION  OF  VESSEL 
D  FAILURE  CAUSED  BY  MATERIAL  DEFECT 
F  IMMEDIATE  DONOR  STRIKES  AGAINST  OBJECT 
F  SHOCK  INITIATION 

F  IMMEDIATE  DONOR  IS  STRUCK  BY  AN  OBJECT 
D  CURRENT  PATH  THROUGH  RECEIVER  TO  EARTH 
F  BUILDUP  OF  STATIC  CHARGE 
D  IMPERFECT  GROUND  PATH 
D  HOT  FRAGMENT 
F  FIRE 

D  ELECTRICAL  EXPLOSIVE 
F  ENERGY  IS  TRANSMITTED 
D  MUNITION  STRIKES  OBJECT 
F  LIGHTNING 

D  MUNITION  IS  STRUCK  BY  OBJECT 
F  FIRE 
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FAULT  TREE  DATA 
GATE  TE  WAS  NOT  USED 
(GATE  MAY  BE  'TOP  EVENT'  GATE) 
*********************************** 

FAULT  TREE  ANALYSIS  PROGRAM 
************************************ 


EXAMPLE  CUT  SETS  FOR  PERSONNEL  INJURY/ FACILITY  DAMAGE 


CUT  SET  # 

BDl 

CHI 

ED  3 

EH2 

EC2 


MUNITION  IS  BEING  TRANSPORTED 
PERSONNEL/ FACILITY  IN  QD 
SAFETY  FEATURES  OVERCOME 
STIMULUS  e . g .  IMPACT 
PROJECTILE  PROPELLED 


CUT  SET  # 

CHI 

CDl 

DDl 

EDI 

P2ED6 


PERSONNEL/ FACILITY  IN  QD 
UNEXPLODED  IS  MUNITION  IS  PROPELLED 
MUNITION  FOLLOWS  PATH  OUT 
WEAK  WALL  DEFEATED 
SABOTAGE 


CUT  SET  # 

CCl 

CDl 

DDl 

EDI 

P2EC3 


IN  VICINITY  OF  UNEXPLODED  RND 
UNEXPLODED  IS  MUNITION  IS  PROPELLED 
MUNITION  FOLLOWS  PATH  OUT 
WEAK  WALL  DEFEATED 
LIGHTNING  STRIKE 


CUT  SET  # 

CHI 

DDl 

DD2 

EDI 

P2FD4 

P2FC4 

P2FD5 


PERSONNEL/ FACILITY  IN  QD 
MUNITION  FOLLOWS  PATH  OUT 
FUZE  FAILS  UNSAFE 
WEAK  WALL  DEFEATED 

CURRENT  PATH  THROUGH  RECEIVER  TO  EARTH 
BUILDUP  OF  STATIC  CHARGE 
IMPERFECT  GROUND  PATH 
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CUT  SET  # 

BD3 

GDI 

DDl 

EHl 

P2FD4 

P2FC4 

P2FD5 


101 

PERSONNEL/ FACILITY  IN  PATH 

UNEXPLODED  IS  MUNITION  IS  PROPELLED 

MUNITION  FOLLOWS  PATH  OUT 

DOOR  OPENED  FOR  HANDLING 

CURRENT  PATH  THROUGH  RECEIVER  TO  EARTH 

BUILDUP  OF  STATIC  CHARGE 

IMPERFECT  GROUND  PATH 


CUT  SET  # 

BD3 

CDl 

DDl 

ED2 

P2FD4 

P2FC4 

P2FD5 


102 

PERSONNEL/ FACILITY  IN  PATH 
UNEXPLODED  IS  MUNITION  IS  PROPELLED 
MUNITION  FOLLOWS  PATH  OUT 
CATASTROPHIC  LOSS  OF  STRUCTURE 
CURRENT  PATH  THROUGH  RECEIVER  TO  EARTH 
BUILDUP  OF  STATIC  CHARGE 
IMPERFECT  GROUND  PATH 


CUT  SET  # 

BD3 

DDl 

DD2 

EHl 

P2FD4 

P2FC4 

P2FD5 


107 

PERSONNEL/ FACILITY  IN  PATH 

MUNITION  FOLLOWS  PATH  OUT 

FUZE  FAILS  UNSAFE 

DOOR  OPERD  FOR  HANDLING 

CURRENT  PATH  THROUGH  RECEIVER  TO  EARTH 

BUILDUP  OF  STATIC  CHARGE 

IMPERFECT  GROUND  PATH 
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Logic  Model  of  the  Top  Event 

The  figure  is  a  depiction  of  the  fault  tree  described  in 
the  text.  It  has  59  basic  events  connected  through  33  gates  to 
intermediate  events  leading  to  the  head  or  top  event.  At  least 
some  of  the  fault  events  at  the  bottom  of  the  tree  must  exist 
before  the  top  event  can  occur.  This  can  be  shown  using  the 
Laws  of  Boolean  Algebra.  The  following  symbols  are  directly 
taken  from  the  figure: 


^Top  Event  ^A1  ^  ^A2  ^  ^A3 

where:  Prop  Event  “  probability  of  occurrence  of  the 

Top  Event . 

=  the  probability  a  round  of  ammunition  is 
outside  the  structure,  left  branch  of  the  tree. 

P^2  =  the  probability  a  person  or  facility  is 
exposed,  center  branch  of  the  tree. 

P^  =  the  probability  a  round  of  ammunition 
transmits  energy,  right  branch  of  the  tree. 

If  the  probability  of  occurrence  of  the  undesired  event. 

Prop  Event'  Were  to  be  calculated,  it  would  be  the  product 
of  probabilities  of  the  three  directly  contributing  branches. 

The  tree  depicted  in  this  paper  has  been  condensed  from  one 
contained  in  AMC  Action  Committee  for  System  Safety  Technical 
Report  90-4.  It  has  roughly  an  eighth  the  resolution  of  that 
tree. 

Logic  Model  of  the  Kickout  Branch 

Kickout  is  the  only  event  in  the  third  rank  of  the 
left-hand  branch  that  is  a  rare  event.  Both  BDl  and  BD2  are 
regularly  occurring  events.  Discount  the  cases  where  a  munition 
is  outside  a  containment  structure  while  being  manipulated  -  as 
in  BDl  and  BD2,  and  consider  the  case  of  the  undesired  outcome 
occurring  as  a  result  of  a  kickout.  What  contribution  does  a 
kickout  play  in  the  probability  of  occurrence  of  the  Top  Event? 
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Kickout  is  very  unlikely.  This  is  obvious  because  of  the 
circumstances  necessary  to  cause  it.  For  a  kickout  to  occur/ 
there  must  be  an  impulsive  event.  That  event  must  create  an 
opening  in  the  structure  or  magazine  containing  the  munitions, 
and  given  an  event  has  occurred,  there  must  be  munitions 
remaining  that  are  then  propelled  through  the  opening  in  the 
structure . 


So  That: 

And: 

Therefore: 


BBl  =  CB1*CB2 

CBl  =  DB3+DB4+DB5 

CB2  =  DD1*(ED1+EC1+EH1+ED2) 

DB3  =  EH3*(FD1+FC1+FD2) 

DB4  =  ED4*EB2*ED5 

=  ED4*ED5* (FC2+FD3+FC3+GD1+GC1+GD2) 

DBS  =  EC3+ED6+FD4*FC4*FD5 

CBl  =  EH3*(FD1+FC1+FD2)+EC3+ED6+FD4*FC4*FD5 
+ED4*ED5*(FC2+FD3+FC3+GD1+GC1+GD2) 

CB2  =  DD1*ED1+DD1*EC1+DD1*EH1+DD1*ED2 

BBl  =  {EH3*(FD1+FC1+FD2)+EC3+ED6+FD4*FC4*FD5+ED4*ED5* 
(FC2+FD3+FC3+GD1+GC1+GD2) }*{  DD1*ED1+DD1*EC1+ 
DD1*EH1+DD1*ED2 } 


By  examining  the  Boolean  statement  for  kickout  (Event  BBl) , 
48  cut  sets  can  be  identified.  The  cut  sets  are  three,  four,  or 
five  point  failures.  This  implies  that  the  Top  Event  occurring 
as  a  result  of  a  kickout  requires  the  contribution  of  at  least 
five  basic  events.  For  this  case,  TE  seems  to  have  a  remote 
probability  of  occurrence  -  at  least  qualitatively  -  since  it 
depends  on  the  sum  of  five,  six,  and  seven  point  failures.  The 
probability  of  the  top  event's  occurring  is  the  sum  of  the 
products  of  the  probabilities  of  the  minimal  cut  sets. 

Conclusion 


Because  the  developed  Fault  Tree  model  was  more 
extensive  than  was  anticipated,  it  was  impractical,  given  the 
scope  of  this  study,  to  quantify.  Even  so,  it  is  clear  the  pos¬ 
sibility  of  the  Top  Event  occurring  does  exist,  but  only  if  the 
complex  set  of  conditions  defined  by  the  tree  have  been  satis¬ 
fied.  The  fault  tree  confirms  a  number  of  scenaria  whereby  an 
injury  or  damage  resulting  from  a  kickout  could  occur.  There 
are  many  event  combinations  that  could  cause  this.  Equally 
obvious  is  that  there  is  no  way  to  reduce  P^^gp  event) 
zero.  This  implies  there  will  always  be  a  risk  of  kickout. 
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Elimination  of  the  possibility  of  the  head  Event  is  impossible. 
However,  a  long  string  of  events,  which  is  diagramed  in  each 
branch  of  the  tree,  is  required  to  satisfy  that  condition.  What 
makes  the  chance  of  a  kickout  that  causes  injury  or  damage  seem 
so  remote  is  each  of  the  events  that  can  cause  that  outcome  is 
an  accident.  Further,  these  accidental  events  must  occur  in 
combinations  of  five,  six,  or  seven;  since  they  must  occur 
serially,  the  combination  of  events  is  very  unlikely. 

Whatever  the  risk  of  ammunition  kickout,  it  is  not  markedly 
different  for  any  suppressive  structure,  regardless  of  con¬ 
struction  style,  if  that  structure  has  a  frangible  wall  that 
will  be  lost  in  a  detonation  or  an  entrance  way  that  allows 
direct  access  from  the  outside.  This  is  explicitly  defined  by 
the  fault  tree  contained  herein. 


i 
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Cut  Set  -  a  combination  of  fault  events  whose  occurrence  as  a  set 
will  cause  the  top  event. 

Donor  -  a  round  of  ammunition  which  functions  in  the  vicinity  of 
other  rounds  of  ammunition  thus  imparting  energy  to  them. 

Event 


a.  When  regarding  ammunition,  a  detonation  or  explosion. 

b.  An  occurrence  in  the  tree. 

Head  or  Top  Event  -  the  main  event  of  the  fault  tree,  the 
undesired  outcome. 

Immediate  Donor  -  The  donor  munition  that  initiates  an  unconfined 
munition . 

Kickout  -  when  a  round  of  ammunition  which  does  not  detonate  from 
an  initial  event  in  a  structure  is  thrown  from  the  structure. 

Receiver  -  a  round  of  ammunition  which  receives  energy  when 
another  round  of  ammunition  in  the  vicinity  functions. 

Risk  -  the  expected  value  associated  with  a  given  hazard;  it  is 
the  product  of  the  severity  of  a  hazard  and  the  likelihood  of  its 
occurrence.  Probabilities  have  not  been  calculated  or  assigned  to 
individual  events  because  it  is  beyond  the  scope  of  this  report  to 
do  so.  In  this  report,  risk  has  several  contexts:  when  pertaining 
to  kickout,  it  is  the  consequence  caused  by  a  round  detonating  or 
escaping  a  containment  structure  after  an  event  has  occurred; 
when  pertaining  to  a  fault  tree,  it  is  the  head  event. 

Unrelated  -  People  or  facilities  which  are  not  directly  involved 
in  a  testing  scenario  but  could  be  injured  or  damaged  because  of 
their  proximity  to  a  test  when  a  kickout  occurs. 
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